tiny-http-mcp-server 0.1.33 → 0.1.34

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.33",
+      "version": "0.1.34",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -119,6 +119,16 @@ Explicit ID/secret values must agree with the imported response. Sessions and
 native registration stores retain arrays, issuance/expiry timestamps and JSON
 provider metadata. Registration input is copied, bounded to 64 KiB and 64
 levels, and rejects invalid standard field types and non-JSON extensions.
+Set `client.tokenEndpointAuthMethod` to `none`, `client_secret_post` or
+`client_secret_basic`; a full registration can supply the same field as
+`token_endpoint_auth_method`. Public clients never transmit a stored secret.
+Basic credentials are individually form-encoded before Base64 encoding and
+are omitted from the form body. Cached grants retain their registered method;
+an explicitly different configured method requires separate persistence or a
+reset. Native DCR chooses a supported method, preferring public PKCE when
+advertised. Unsupported methods and missing confidential secrets fail before
+token requests. Existing clients without a method keep the previous default:
+body authentication when a secret is present, public authentication otherwise.
 Static clients and dynamic initial-grant imports require cached grants to match
 the original normalized client ID and secret. A different client configuration
 fails before attaching or refreshing credentials and retains the stored record;

package/node_modules/mcp-oauth/dist/client/client-registration.js

@@ -1,4 +1,5 @@
 import { normalizeOAuthScope } from "./scope.js";
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 /** Validate and copy a bounded JSON DCR response without quoting credential input. */
 export function parseOAuthClientRegistration(value) {
     const invalid = () => new Error("Invalid OAuth client registration metadata");
@@ -83,12 +84,20 @@ export function normalizeStoredOAuthClient(value) {
         (clientSecret !== undefined && (typeof clientSecret !== "string" || clientSecret.trim() === "")))
         return null;
     const client = { clientId: clientId.trim(), ...(clientSecret === undefined ? {} : { clientSecret: clientSecret.trim() }) };
+    const method = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(record, "tokenEndpointAuthMethod") ? record.tokenEndpointAuthMethod : undefined);
     if (Object.hasOwn(record, "registration") && record.registration !== undefined) {
         const registration = parseOAuthClientRegistration(record.registration);
         const registeredSecret = Object.hasOwn(registration, "client_secret") ? registration.client_secret?.trim() : undefined;
         if (registration.client_id.trim() !== client.clientId || registeredSecret !== client.clientSecret)
             throw new Error("OAuth client registration does not match the client identity");
         client.registration = registration;
+        const registrationMethod = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(registration, "token_endpoint_auth_method") ? registration.token_endpoint_auth_method : undefined);
+        if (method !== undefined && registrationMethod !== undefined && method !== registrationMethod)
+            throw new Error("OAuth token endpoint authentication conflicts with the client registration");
+        if (registrationMethod !== undefined)
+            client.tokenEndpointAuthMethod = registrationMethod;
     }
+    if (method !== undefined)
+        client.tokenEndpointAuthMethod = method;
     return client;
 }

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,5 +1,6 @@
 import { normalizeStoredOAuthClient, parseOAuthClientRegistration } from "./client-registration.js";
 import { normalizeOAuthScope } from "./scope.js";
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 import { isIP } from "node:net";
 import { fetchMcpResponse } from "../http-fetch.js";
 import { URL } from "node:url";
@@ -23,6 +24,8 @@ export function createDefaultOAuthClientProvider(options) {
     const clientMetadata = getClientMetadata(options.client);
     const requestedScope = clientMetadata?.scope;
     const configuredClient = normalizeConfiguredClient(options.client);
+    const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
+    const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
     const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
     const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
     const now = options.now ?? Date.now;
@@ -156,6 +159,9 @@ export function createDefaultOAuthClientProvider(options) {
             }
             if (requestedScope !== undefined && session?.tokens !== undefined && normalizeOAuthScope(session.tokens.scope ?? session.requestedScope) !== requestedScope)
                 throw new Error("Stored session does not match the requested OAuth scope; authorize again or select separate persistence");
+            if (configuredTokenMethod !== undefined && session !== null && (session.tokens !== undefined || session.refreshState === "pending") &&
+                (session.client.tokenEndpointAuthMethod ?? (session.client.clientSecret === undefined ? "none" : "client_secret_post")) !== configuredTokenMethod)
+                throw new Error("Stored session does not match the requested OAuth token endpoint authentication; select separate persistence or reset it");
             if (session?.refreshState === "pending") {
                 if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === undefined)
                     throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
@@ -190,6 +196,7 @@ export function createDefaultOAuthClientProvider(options) {
         if (session.tokens?.refreshToken === undefined) {
             return session;
         }
+        assertTokenEndpointAuthentication(session.client, discovery.authorizationServerMetadata);
         const pendingSession = { ...clearSessionTokens(session), refreshState: "pending" };
         await saveSession(resource, pendingSession);
         signal?.throwIfAborted();
@@ -201,6 +208,7 @@ export function createDefaultOAuthClientProvider(options) {
                     tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
                     clientId: session.client.clientId,
                     clientSecret: session.client.clientSecret,
+                    tokenEndpointAuthMethod: session.client.tokenEndpointAuthMethod,
                     refreshToken: session.tokens.refreshToken,
                     resource,
                     fetch, signal,
@@ -266,6 +274,7 @@ export function createDefaultOAuthClientProvider(options) {
             let resolvedClient = null;
             try {
                 resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch, signal);
+                assertTokenEndpointAuthentication(resolvedClient.client, discovery.authorizationServerMetadata);
                 const sessionWithoutTokens = {
                     resource,
                     authorizationServer: discovery.authorizationServer,
@@ -289,6 +298,7 @@ export function createDefaultOAuthClientProvider(options) {
                     tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
                     clientId: resolvedClient.client.clientId,
                     clientSecret: resolvedClient.client.clientSecret,
+                    tokenEndpointAuthMethod: resolvedClient.client.tokenEndpointAuthMethod,
                     code,
                     codeVerifier: verifier,
                     redirectUri: loopback.redirectUri,
@@ -378,7 +388,12 @@ export function createDefaultOAuthClientProvider(options) {
                 };
             }
         }
-        const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri);
+        const supported = getSupportedTokenAuthMethods(discovery.authorizationServerMetadata);
+        const registrationMethod = requestedTokenMethod ?? (supported === undefined ? "none" :
+            ["none", "client_secret_basic", "client_secret_post"].find(method => supported.includes(method)));
+        if (registrationMethod === undefined || (supported !== undefined && !supported.includes(registrationMethod)))
+            throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+        const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri, registrationMethod);
         const deadline = AbortSignal.timeout(30_000);
         const signal = parentSignal === undefined ? deadline : AbortSignal.any([parentSignal, deadline]);
         const response = await fetchMcpResponse(fetch, registrationEndpoint, {
@@ -392,9 +407,12 @@ export function createDefaultOAuthClientProvider(options) {
         const payload = await readOAuthJsonObjectResponse(response, signal);
         const registration = parseOAuthClientRegistration(payload);
         const registeredSecret = getOwnString(registration, "client_secret");
+        const responseMethod = normalizeOAuthTokenEndpointAuthMethod(getOwnEntry(registration, "token_endpoint_auth_method")) ??
+            requestedTokenMethod ?? (supported === undefined ? undefined : normalizeOAuthTokenEndpointAuthMethod(registrationMethod));
         const registeredClient = {
             clientId: registration.client_id.trim(),
             ...(registeredSecret === undefined ? {} : { clientSecret: registeredSecret.trim() }),
+            ...(responseMethod === undefined ? {} : { tokenEndpointAuthMethod: responseMethod }),
             registration
         };
         await saveRegisteredClient(discovery.authorizationServer, registeredClient);
@@ -408,7 +426,7 @@ export function createDefaultOAuthClientProvider(options) {
         return normalizeLoadedSession(await sessionStore.load(resource));
     }
     async function saveSession(resource, session) {
-        await sessionStore.save(resource, session);
+        await sessionStore.save(resource, structuredClone(session));
     }
     async function clearSession(resource) {
         await sessionStore.clear(resource);
@@ -564,7 +582,7 @@ function normalizeConfiguredClient(client) {
     if (clientId === undefined)
         return null;
     const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === undefined ? undefined : getOwnString(registration, "client_secret")?.trim());
-    return normalizeStoredOAuthClient({ clientId, clientSecret, registration });
+    return normalizeStoredOAuthClient({ clientId, clientSecret, registration, tokenEndpointAuthMethod: client.tokenEndpointAuthMethod });
 }
 function normalizeOptionalOAuthString(value) {
     if (value === undefined) {
@@ -671,12 +689,28 @@ function assertRequestMatchesResource(requestUrl, resource) {
         throw new Error(`OAuth request URL ${requestUrl} does not match discovered resource ${resource}`);
     }
 }
-function buildClientRegistrationBody(metadata, redirectUri) {
+function getSupportedTokenAuthMethods(metadata) {
+    const value = getOwnEntry(metadata, "token_endpoint_auth_methods_supported");
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length > 128 || value.some(method => typeof method !== "string"))
+        throw new Error("Invalid OAuth token endpoint authentication metadata");
+    return value;
+}
+function assertTokenEndpointAuthentication(client, metadata) {
+    const method = client.tokenEndpointAuthMethod ?? (client.clientSecret === undefined ? "none" : "client_secret_post");
+    if (method !== "none" && client.clientSecret === undefined)
+        throw new Error("OAuth token endpoint authentication requires a client secret");
+    const supported = getSupportedTokenAuthMethods(metadata);
+    if (supported !== undefined && !supported.includes(method))
+        throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+}
+function buildClientRegistrationBody(metadata, redirectUri, tokenEndpointAuthMethod) {
     const body = {
         redirect_uris: [redirectUri],
         grant_types: ["authorization_code", "refresh_token"],
         response_types: ["code"],
-        token_endpoint_auth_method: "none"
+        token_endpoint_auth_method: tokenEndpointAuthMethod
     };
     const clientName = metadata === undefined ? undefined : getOwnString(metadata, "clientName");
     const scope = metadata === undefined ? undefined : getOwnString(metadata, "scope");

package/node_modules/mcp-oauth/dist/client/token-auth-method.d.ts

@@ -0,0 +1,2 @@
+import type { OAuthTokenEndpointAuthMethod } from "./types.js";
+export declare function normalizeOAuthTokenEndpointAuthMethod(value: unknown): OAuthTokenEndpointAuthMethod | undefined;

package/node_modules/mcp-oauth/dist/client/token-auth-method.js

@@ -0,0 +1,7 @@
+export function normalizeOAuthTokenEndpointAuthMethod(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (value !== "none" && value !== "client_secret_post" && value !== "client_secret_basic")
+        throw new Error("Unsupported OAuth token endpoint authentication method");
+    return value;
+}

package/node_modules/mcp-oauth/dist/client/token-endpoint.d.ts

@@ -1,4 +1,4 @@
-import type { OAuthMetadataFetch, StoredOAuthTokens } from "./types.js";
+import type { OAuthMetadataFetch, StoredOAuthTokens, OAuthTokenEndpointAuthMethod } from "./types.js";
 interface OAuthErrorShape {
     error: string;
     error_description?: string;
@@ -22,6 +22,7 @@ export declare function exchangeAuthorizationCode(input: {
     tokenEndpoint: string;
     clientId: string;
     clientSecret?: string;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     code: string;
     codeVerifier: string;
     redirectUri: string;
@@ -34,6 +35,7 @@ export declare function refreshAccessToken(input: {
     tokenEndpoint: string;
     clientId: string;
     clientSecret?: string;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     refreshToken: string;
     resource: string;
     fetch: OAuthMetadataFetch;

package/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -1,3 +1,4 @@
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
 import { readBoundedResponseText } from "../http-response.js";
 import { fetchMcpResponse } from "../http-fetch.js";
@@ -40,6 +41,7 @@ export async function exchangeAuthorizationCode(input) {
         tokenEndpoint: input.tokenEndpoint,
         clientId: input.clientId,
         clientSecret: input.clientSecret,
+        tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
         params: {
             grant_type: "authorization_code",
             code: input.code,
@@ -58,6 +60,7 @@ export async function refreshAccessToken(input) {
         tokenEndpoint: input.tokenEndpoint,
         clientId: input.clientId,
         clientSecret: input.clientSecret,
+        tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
         params: {
             grant_type: "refresh_token",
             refresh_token: input.refreshToken,
@@ -69,21 +72,28 @@ export async function refreshAccessToken(input) {
     });
 }
 async function requestTokens(input) {
-    const body = new URLSearchParams({
-        client_id: input.clientId,
-        ...input.params
-    });
-    if (input.clientSecret !== undefined) {
-        body.set("client_secret", input.clientSecret);
+    const method = normalizeOAuthTokenEndpointAuthMethod(input.tokenEndpointAuthMethod) ??
+        (input.clientSecret === undefined ? "none" : "client_secret_post");
+    if (method !== "none" && (input.clientSecret === undefined || input.clientSecret.trim() === ""))
+        throw new Error("OAuth token endpoint authentication requires a client secret");
+    const body = new URLSearchParams(input.params);
+    const headers = new Headers({ "Content-Type": "application/x-www-form-urlencoded" });
+    if (method === "client_secret_basic") {
+        const encoded = new URLSearchParams({ credential: input.clientId }).toString().slice("credential=".length);
+        const encodedSecret = new URLSearchParams({ credential: input.clientSecret }).toString().slice("credential=".length);
+        headers.set("Authorization", `Basic ${Buffer.from(`${encoded}:${encodedSecret}`).toString("base64")}`);
+    }
+    else {
+        body.set("client_id", input.clientId);
+        if (method === "client_secret_post")
+            body.set("client_secret", input.clientSecret);
     }
     input.signal?.throwIfAborted();
     const deadline = AbortSignal.timeout(30_000);
     const signal = input.signal === undefined ? deadline : AbortSignal.any([input.signal, deadline]);
     const response = await fetchMcpResponse(input.fetch, input.tokenEndpoint, {
         method: "POST",
-        headers: {
-            "Content-Type": "application/x-www-form-urlencoded"
-        },
+        headers,
         body: body.toString(),
         signal
     });

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -86,7 +86,9 @@ export interface StoredOAuthClient {
     clientId: string;
     clientSecret?: string;
     registration?: OAuthClientRegistration;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
 }
+export type OAuthTokenEndpointAuthMethod = "none" | "client_secret_post" | "client_secret_basic";
 export interface StoredOAuthSession {
     resource: string;
     authorizationServer: string;
@@ -120,12 +122,14 @@ export interface DefaultOAuthClientProviderOptions {
         metadata?: OAuthClientMetadata;
         /** Import a complete registration owned by the caller. */
         registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     } | {
         mode: "static";
         clientId: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
         registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;

package/node_modules/mcp-oauth/dist/index.d.ts

@@ -6,7 +6,7 @@ export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";
 export { OAuthError, } from "./client/token-endpoint.js";
 export { canonicalizeResourceIndicator, } from "./resource-indicator.js";
 export { createJwksTokenVerifier, } from "./server/jwks-token-verifier.js";
-export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientRegistration, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, StoredOAuthSession, StoredOAuthClient, StoredOAuthTokens, } from "./client/types.js";
+export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientRegistration, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, OAuthTokenEndpointAuthMethod, StoredOAuthSession, StoredOAuthClient, StoredOAuthTokens, } from "./client/types.js";
 export type { JwksTokenVerifier, JwksTokenVerifierOptions, JwksVerifiedAccessToken, } from "./server/jwks-token-verifier.js";
 export type { LoopbackAuthorizationOptions, LoopbackAuthorizationSession, OAuthLandingPage, } from "./client/loopback-authorization.js";
 export { readBoundedResponseText } from "./http-response.js";

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -189,7 +189,9 @@ interface StoredOAuthClient {
     clientId: string;
     clientSecret?: string;
     registration?: OAuthClientRegistration;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
 }
+type OAuthTokenEndpointAuthMethod = "none" | "client_secret_post" | "client_secret_basic";
 interface StoredOAuthSession {
     resource: string;
     authorizationServer: string;
@@ -223,12 +225,14 @@ interface DefaultOAuthClientProviderOptions {
         metadata?: OAuthClientMetadata;
         /** Import a complete registration owned by the caller. */
         registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     } | {
         mode: "static";
         clientId: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
         registration?: OAuthClientRegistration;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3405,6 +3405,15 @@ function normalizeOAuthScope(scope) {
   return normalized || void 0;
 }
 
+// ../mcp-oauth/dist/client/token-auth-method.js
+function normalizeOAuthTokenEndpointAuthMethod(value) {
+  if (value === void 0 || value === null)
+    return void 0;
+  if (value !== "none" && value !== "client_secret_post" && value !== "client_secret_basic")
+    throw new Error("Unsupported OAuth token endpoint authentication method");
+  return value;
+}
+
 // ../mcp-oauth/dist/client/client-registration.js
 function parseOAuthClientRegistration(value) {
   const invalid = () => new Error("Invalid OAuth client registration metadata");
@@ -3503,13 +3512,21 @@ function normalizeStoredOAuthClient(value) {
   if (typeof clientId !== "string" || clientId.trim() === "" || clientSecret !== void 0 && (typeof clientSecret !== "string" || clientSecret.trim() === ""))
     return null;
   const client = { clientId: clientId.trim(), ...clientSecret === void 0 ? {} : { clientSecret: clientSecret.trim() } };
+  const method = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(record2, "tokenEndpointAuthMethod") ? record2.tokenEndpointAuthMethod : void 0);
   if (Object.hasOwn(record2, "registration") && record2.registration !== void 0) {
     const registration = parseOAuthClientRegistration(record2.registration);
     const registeredSecret = Object.hasOwn(registration, "client_secret") ? registration.client_secret?.trim() : void 0;
     if (registration.client_id.trim() !== client.clientId || registeredSecret !== client.clientSecret)
       throw new Error("OAuth client registration does not match the client identity");
     client.registration = registration;
-  }
+    const registrationMethod = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(registration, "token_endpoint_auth_method") ? registration.token_endpoint_auth_method : void 0);
+    if (method !== void 0 && registrationMethod !== void 0 && method !== registrationMethod)
+      throw new Error("OAuth token endpoint authentication conflicts with the client registration");
+    if (registrationMethod !== void 0)
+      client.tokenEndpointAuthMethod = registrationMethod;
+  }
+  if (method !== void 0)
+    client.tokenEndpointAuthMethod = method;
   return client;
 }
 
@@ -4760,6 +4777,7 @@ async function exchangeAuthorizationCode(input) {
     tokenEndpoint: input.tokenEndpoint,
     clientId: input.clientId,
     clientSecret: input.clientSecret,
+    tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
     params: {
       grant_type: "authorization_code",
       code: input.code,
@@ -4778,6 +4796,7 @@ async function refreshAccessToken(input) {
     tokenEndpoint: input.tokenEndpoint,
     clientId: input.clientId,
     clientSecret: input.clientSecret,
+    tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
     params: {
       grant_type: "refresh_token",
       refresh_token: input.refreshToken,
@@ -4789,21 +4808,26 @@ async function refreshAccessToken(input) {
   });
 }
 async function requestTokens(input) {
-  const body = new URLSearchParams({
-    client_id: input.clientId,
-    ...input.params
-  });
-  if (input.clientSecret !== void 0) {
-    body.set("client_secret", input.clientSecret);
+  const method = normalizeOAuthTokenEndpointAuthMethod(input.tokenEndpointAuthMethod) ?? (input.clientSecret === void 0 ? "none" : "client_secret_post");
+  if (method !== "none" && (input.clientSecret === void 0 || input.clientSecret.trim() === ""))
+    throw new Error("OAuth token endpoint authentication requires a client secret");
+  const body = new URLSearchParams(input.params);
+  const headers = new Headers({ "Content-Type": "application/x-www-form-urlencoded" });
+  if (method === "client_secret_basic") {
+    const encoded = new URLSearchParams({ credential: input.clientId }).toString().slice("credential=".length);
+    const encodedSecret = new URLSearchParams({ credential: input.clientSecret }).toString().slice("credential=".length);
+    headers.set("Authorization", `Basic ${Buffer.from(`${encoded}:${encodedSecret}`).toString("base64")}`);
+  } else {
+    body.set("client_id", input.clientId);
+    if (method === "client_secret_post")
+      body.set("client_secret", input.clientSecret);
   }
   input.signal?.throwIfAborted();
   const deadline = AbortSignal.timeout(3e4);
   const signal = input.signal === void 0 ? deadline : AbortSignal.any([input.signal, deadline]);
   const response = await fetchMcpResponse(input.fetch, input.tokenEndpoint, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
+    headers,
     body: body.toString(),
     signal
   });
@@ -4957,6 +4981,8 @@ function createDefaultOAuthClientProvider(options) {
   const clientMetadata = getClientMetadata(options.client);
   const requestedScope = clientMetadata?.scope;
   const configuredClient = normalizeConfiguredClient(options.client);
+  const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
+  const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
   const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
   const clientStore = options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
   const now = options.now ?? Date.now;
@@ -5085,6 +5111,8 @@ function createDefaultOAuthClientProvider(options) {
       }
       if (requestedScope !== void 0 && session?.tokens !== void 0 && normalizeOAuthScope(session.tokens.scope ?? session.requestedScope) !== requestedScope)
         throw new Error("Stored session does not match the requested OAuth scope; authorize again or select separate persistence");
+      if (configuredTokenMethod !== void 0 && session !== null && (session.tokens !== void 0 || session.refreshState === "pending") && (session.client.tokenEndpointAuthMethod ?? (session.client.clientSecret === void 0 ? "none" : "client_secret_post")) !== configuredTokenMethod)
+        throw new Error("Stored session does not match the requested OAuth token endpoint authentication; select separate persistence or reset it");
       if (session?.refreshState === "pending") {
         if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === void 0)
           throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
@@ -5117,6 +5145,7 @@ function createDefaultOAuthClientProvider(options) {
     if (session.tokens?.refreshToken === void 0) {
       return session;
     }
+    assertTokenEndpointAuthentication(session.client, discovery.authorizationServerMetadata);
     const pendingSession = { ...clearSessionTokens(session), refreshState: "pending" };
     await saveSession(resource, pendingSession);
     signal?.throwIfAborted();
@@ -5128,6 +5157,7 @@ function createDefaultOAuthClientProvider(options) {
           tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
           clientId: session.client.clientId,
           clientSecret: session.client.clientSecret,
+          tokenEndpointAuthMethod: session.client.tokenEndpointAuthMethod,
           refreshToken: session.tokens.refreshToken,
           resource,
           fetch: fetch2,
@@ -5191,6 +5221,7 @@ function createDefaultOAuthClientProvider(options) {
       let resolvedClient = null;
       try {
         resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch2, signal);
+        assertTokenEndpointAuthentication(resolvedClient.client, discovery.authorizationServerMetadata);
         const sessionWithoutTokens = {
           resource,
           authorizationServer: discovery.authorizationServer,
@@ -5214,6 +5245,7 @@ function createDefaultOAuthClientProvider(options) {
           tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
           clientId: resolvedClient.client.clientId,
           clientSecret: resolvedClient.client.clientSecret,
+          tokenEndpointAuthMethod: resolvedClient.client.tokenEndpointAuthMethod,
           code,
           codeVerifier: verifier,
           redirectUri: loopback.redirectUri,
@@ -5300,7 +5332,11 @@ function createDefaultOAuthClientProvider(options) {
         };
       }
     }
-    const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri);
+    const supported = getSupportedTokenAuthMethods(discovery.authorizationServerMetadata);
+    const registrationMethod = requestedTokenMethod ?? (supported === void 0 ? "none" : ["none", "client_secret_basic", "client_secret_post"].find((method) => supported.includes(method)));
+    if (registrationMethod === void 0 || supported !== void 0 && !supported.includes(registrationMethod))
+      throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+    const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri, registrationMethod);
     const deadline = AbortSignal.timeout(3e4);
     const signal = parentSignal === void 0 ? deadline : AbortSignal.any([parentSignal, deadline]);
     const response = await fetchMcpResponse(fetch2, registrationEndpoint, {
@@ -5314,9 +5350,11 @@ function createDefaultOAuthClientProvider(options) {
     const payload = await readOAuthJsonObjectResponse(response, signal);
     const registration = parseOAuthClientRegistration(payload);
     const registeredSecret = getOwnString2(registration, "client_secret");
+    const responseMethod = normalizeOAuthTokenEndpointAuthMethod(getOwnEntry6(registration, "token_endpoint_auth_method")) ?? requestedTokenMethod ?? (supported === void 0 ? void 0 : normalizeOAuthTokenEndpointAuthMethod(registrationMethod));
     const registeredClient = {
       clientId: registration.client_id.trim(),
       ...registeredSecret === void 0 ? {} : { clientSecret: registeredSecret.trim() },
+      ...responseMethod === void 0 ? {} : { tokenEndpointAuthMethod: responseMethod },
       registration
     };
     await saveRegisteredClient(discovery.authorizationServer, registeredClient);
@@ -5330,7 +5368,7 @@ function createDefaultOAuthClientProvider(options) {
     return normalizeLoadedSession(await sessionStore.load(resource));
   }
   async function saveSession(resource, session) {
-    await sessionStore.save(resource, session);
+    await sessionStore.save(resource, structuredClone(session));
   }
   async function clearSession(resource) {
     await sessionStore.clear(resource);
@@ -5466,7 +5504,7 @@ function normalizeConfiguredClient(client) {
   if (clientId === void 0)
     return null;
   const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === void 0 ? void 0 : getOwnString2(registration, "client_secret")?.trim());
-  return normalizeStoredOAuthClient({ clientId, clientSecret, registration });
+  return normalizeStoredOAuthClient({ clientId, clientSecret, registration, tokenEndpointAuthMethod: client.tokenEndpointAuthMethod });
 }
 function normalizeOptionalOAuthString(value) {
   if (value === void 0) {
@@ -5566,12 +5604,28 @@ function assertRequestMatchesResource(requestUrl, resource) {
     throw new Error(`OAuth request URL ${requestUrl} does not match discovered resource ${resource}`);
   }
 }
-function buildClientRegistrationBody(metadata, redirectUri) {
+function getSupportedTokenAuthMethods(metadata) {
+  const value = getOwnEntry6(metadata, "token_endpoint_auth_methods_supported");
+  if (value === void 0)
+    return void 0;
+  if (!Array.isArray(value) || value.length > 128 || value.some((method) => typeof method !== "string"))
+    throw new Error("Invalid OAuth token endpoint authentication metadata");
+  return value;
+}
+function assertTokenEndpointAuthentication(client, metadata) {
+  const method = client.tokenEndpointAuthMethod ?? (client.clientSecret === void 0 ? "none" : "client_secret_post");
+  if (method !== "none" && client.clientSecret === void 0)
+    throw new Error("OAuth token endpoint authentication requires a client secret");
+  const supported = getSupportedTokenAuthMethods(metadata);
+  if (supported !== void 0 && !supported.includes(method))
+    throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+}
+function buildClientRegistrationBody(metadata, redirectUri, tokenEndpointAuthMethod) {
   const body = {
     redirect_uris: [redirectUri],
     grant_types: ["authorization_code", "refresh_token"],
     response_types: ["code"],
-    token_endpoint_auth_method: "none"
+    token_endpoint_auth_method: tokenEndpointAuthMethod
   };
   const clientName = metadata === void 0 ? void 0 : getOwnString2(metadata, "clientName");
   const scope = metadata === void 0 ? void 0 : getOwnString2(metadata, "scope");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.33",
+  "version": "0.1.34",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",